Rails 6.1.x Release Notes

Security Fixes

Active Storage

• CVE-2026-66066 - Disable all untrusted libvips formats.
  • This is a breaking change in any of these situations:
    • If you use libvips < 8.13 or ruby-vips < 2.2.1 this is not possible and Rails will refuse to start. As an emergency escape hatch we provide the RAILS_LTS_ALLOW_UNTRUSTED_VIPS_OPERATIONS=1 environment variable. This should only be used if you know that you don't process files from untrusted users, or when you have configured config.active_storage.variant_processor to use ImageMagick.
    • If your application processes complex file formats like SVG or PDF, ActiveStorage will no longer be able to do so. Formats can be selectively re-enabled (e.g. Vips.block('VipsForeignLoadPdf', false)). This may re-enable the vulnerability since it is not yet public which format enables the exploit.

Security Fixes

• CVE-2026-41316 - Fix for ERB vulnerability when using Marshal.load.

Active Record

• CVE-2022-44566 – Resolve incomplete denial-of-service (DoS) fix from earlier release.

Security Fixes

Action View

• CVE-2026-33168 — Fix possible XSS vulnerability in tag helpers.

Active Storage

• CVE-2026-33658 - Fix possible DoS vulnerability in proxy mode via multi-range requests.
• CVE-2026-33202 — Fix possible glob injection in DiskService.
• CVE-2026-33195 — Fix possible path traversal in DiskService.
• CVE-2026-33174 - Fix possible DoS vulnerability in proxy mode via Range requests.
• CVE-2026-33173 — Fix insufficient filtering of metadata in direct uploads.

Active Support

• CVE-2026-33176 — Fix possible DoS vulnerability in number helpers.
• CVE-2026-33170 — Fix possible XSS vulnerability in SafeBuffer#%.
• CVE-2026-33169 — Fix possible ReDoS vulnerability in number_to_delimited.

Security Fixes

Active Record

• CVE-2025-55193 - Call inspect on ids in RecordNotFound error.

Active Storage

• CVE-2025-24293 - Remove dangerous transformations.

Notes

• This is the initial release of Never-Ending Support (NES) for Rails v6.1.x.

Security Fixes

Action Mailer

• CVE-2024-47889 – Avoid regex backtracking in block_format helper.

Action Pack

• CVE-2024-54133 – Fixed a possible Content Security Policy bypass in Action Dispatch.
• CVE-2024-47887 – Fixed a possible ReDoS vulnerability in HTTP Token authentication in Action Controller.
• CVE-2024-41128 – Fixed a possible ReDoS vulnerability in query parameter filtering in Action Dispatch.

Action Text

• CVE-2024-47888 – Fixed a possible ReDoS vulnerability in plain_text_for_blockquote_node in Action Text.